Construction of anti-counter-training data infrastructure for the security LLM.SQL Infusion、XSS、RCE、Buffer spill、Path Passes、Integrated threat detection8-Strategic Data Set, 5-bit structural label, MITRA ATT&CK full map.
Generating AI is both a striker and a defense revolution. From the LLM-driven automated loophole to the rise of the Security LLM, from the confrontational machine to the AIR Red team, AI is re-establishing a secure cyber-defense pattern.
The next step in the process is the emergence of a dedicated security model, such as Microsoft Security Copitho, Google Sec-PaLM, Palo Alto Cortex XSIAM, based on the GPT-4/Claude structure, which reaches and even surpasses human expertise in threat intelligence, SOC alerts, attack chain reasoning. In the era of Security LLM, high-quality anti-data is a central barrier.
The APT attack detection system based on Transformer and GNN has a 95% accuracy rate on open benchmarks such as DARPA TC, CIC-APT, which greatly exceeds the traditional rule engine. Multistage attack chain identification, TTP reasoning, and abnormal behavior baseline modelling have become hot spots for research, and large-scale, high-quality APT samples are urgently needed.
NIST AI RMF and OWASP LLM Top 10 have made confrontational machine learning a central issue of AI security.
The FBI/IC3 annual report shows that the generation of AI has increased the success rate of fishing mail by 300%, and that Deepfake lost over $500 million in voice fraud. Black-producing LLMs like WorldGPT, FraudGPT are circulating in dark webs, and AI-driven automated loopholes and self-adaptation are reshaping threat patterns.
The MITRE ATT&CK framework has been adopted by more than 80% of the SOC team worldwide, covering 14 major tactics, 200+ technologies. Tools such as ATT&CK Navigator, ATT&CK Eval, CTRAC, drive ATT&CK to industrialize, and the security model must understand TT&CK in depth to be effective in TTTP reasoning and threatening hunting.
Gartner predicts that the AI-driven cybersecurity market will be in excess of $215 billion by 2030, with a compound annual growth rate of 22.8 per cent automated for security operations, AI Threat Intelligence, and Zero Trust AI, which will be the three core tracks, with high-quality counter-attack data as the core strategic resource for AI security.
From Web attack to system loophole, from single point to integrated threat detection, from ATT&CK training to detection capability gaps, five-dimensional structured labels, full mapping of MITRA ATT&CK framework.
1000 ~30,000 five-mix data, covering seven main sub-types such as joint query/blind note/fault-time injection, supports MySQL/PostgreSQL/MSSQL/Oracle multiple databases. ATT&CK T1190 map, with XML detection rules + PCAP flow + HTTP return text + standard answer.
1000 ~30,000 five-mix data, covering five large subtypes such as reflect/storage/DOM/mXSS. Contains bypass technique labels (coding bypass/case confusion/label split/incident mutation), ATT&CK T1189 map, covering HTML/JS/CSS/URL multiple context.
800 ~20,000 five-mix data covering five RCE types such as command injection/re-sequencing/SSTI. Includes Java/PHP/Python back-sequencing Gadget Chain data supporting full chain testing of ysoserial. ATT&CK T1059/T1203 map, overlaying command intruding power to sustain a complete chain of horizontal movement attacks.
500 ~10,000 five-mix data covering stack spills/climbs/formatization string/integers spills four types of system-level leaks. ATT&CK T1203 map, binary security AI training specialise, with rules defined to complete closed loops for validation assessment, supports CGC training language generation.
800 ~20,000 five-mix data covering directory crossing/LFI/RFI/pathic standardization bypasses four types of attack. Enriched code bypasses Payload (URL/Double/Unicode/UTF-8 overlong/nulla byte/path cut-off), ATT&CK T1083/T1005 map.
2,000~50,000 multi-type threat five-mix data covering the main web/network/host/unicable/API/0day 6 categories. The complete AT&CK map+Cyclastic Chain Phase is marked as the complete textual basis for the security LLM pre-training, achieving "One Model for All Threats".
1000 ~ 20,000 ATT&CK training data on offensive techniques, 14 tactical/200+ technology is fully covered. Each contains ATT&CK technical metadata, attack description, detection methods, mitigation measures, process examples, and PRAP connections.
500 ~ 1,500 high-value detection gap analysis + TTP reasoning chain, log data source map. Covers the full chain from gap identification to rule generation, five-dimensional linkage structure, training specializing in testing engineering automation, and supporting SIEM rule smart generation and red and blue confrontation simulations.
All SDSs are structured using a unified five-dimensional (actually six-dimensional) linkage structure, covering the full closed loop from the rule definition to flow validation, and providing a structured training base for Secure LLM.
Only rule ID, ATT&CK technology ID mapping, type of attack, serious grade, CVE association, etc.
Structured XML format test rule definition, with regular features, matching conditions, action type, can be consumed directly by WAF/IDS/SIEM
A real attack on Payload sample, with bypass techniques, code variants, Gadget Chain, etc., covering mainstream attack tactics and variants
Full HTTP request/response return text with full volume fields such as Header, Body, Cookie, URL, to facilitate NLP model understanding
Original PCAP data, complete information on the network layer (TCP/IP, TLS handshake, time series, etc.) to support traffic analysis model training
Standard answers (attack/normal, type, severity) marked by manual experts for model SFT/RLHF training and assessment
The Lang Hui security data set is a comprehensive map of the MITRA TATT&CK framework, covering the complete attack from the initial access to the impact, Kill Chain. Green cells represent the technology areas that are covered.
Each data is structured using a five-dimensional format, with full indication of traffic from ATT& CK metadata to PCAP.
{
"rule_id": "SQLI-2026-UNION-0001",
"attack_type": "SQL Injection",
"sub_type": "Union-based",
"mitre_attack": "T1190",
"severity": "CRITICAL",
"xml_rule": "UNION.+SELECT From WAF rule generation and security language-model training to SOC automation and red-team/blue-team exercises, Langhui datasets support a range of AI security workflows.
The Integrated Threat Detection Data Set (ITDS) serves as the complete textual base for the Security LLM, covering the WEb/Net/host/unicable/API/0day6 categories, and achieves "One Mode for All Threats". The ATT&CK Training Data Set is complemented by SFT to inject TTP reasoning capabilities.
The XML test rules for SQL injection/XSS/RCE/path through data sets can be consumed directly by WAF, training LLM to automatically generate detection rules for new types of attacks, increase coverage by 40%+ and reduce the misreporting rate by 60%+.
The multi-attack composite data set based on the ATT&CK framework trains SOC AI analysts to automate alerting to police consultations, threatening hunting, and attacking chain reasoning.
The ATT&CK training data set supports the verification of the Red Team TTP simulation and Blue Team testing, which automatically generates the attack script and detection rules.
The RCE/Buffer Exploiting Data Set Training Code Audit Model, which automatically identifies the inverse-sequencing Gadget Chain, stack-spill, formatted strings, etc., supports Java/PHP/Python/C/C++ multilingualism.
The ATT&CK training data set gives LLM the capability to understand TTP (tactical/technical/process) in depth, to delineate the full chain of attack from a single warning, to link threat intelligence and to predict the next action of the assailant.
The DataAssetsAPI platform, Long Salang Langhui Information Technology, aims to provide a high-quality, compliant anti-data infrastructure for security teams and AI enterprises. From SQL, it is injected into a comprehensive threat, from ATT&CK training to detection capacity gaps, and it is building a security LLM training loop.